This is a good write up of a tricky vulnerability.
I spent lots of time working on USSD stuff with Android apps - it has always been ignored by Google. I guess because it isn't widely used in the US?
@karansaini.comNew blog post: 1-click MMI execution in Android. Applications with CALL_PHONE permission and flawed dialer deeplinking can be exploited from the browser to silently register call forwarding. Read here: karansaini.com/mmi-android/
karansaini.com
1-click MMI execution in Android
An application with the CALL_PHONE permission can execute carrier MMI/USSD codes with no user confirmation. A vulnerable application with browsable deeplinks can trigger MMI execution with a single ta...